CVSS: 4.4EPSS: 0%CPEs: 7EXPL: 0CVE-2009-1009
https://notcve.org/view.php?id=CVE-2009-1009
Unspecified vulnerability in the Outside In Technology component in Oracle Application Server 8.1.9 allows local users to affect confidentiality, integrity, and availability, related to HTML. Vulnerabilidad no especificada en el componente Outside In Technology en Oracle Application Server v8.1.9 que permite a los usuarios locales afectar a la confidencialidad, integridad y disponibilidad en relación a HTML. • http://osvdb.org/53748 http://secunia.com/advisories/34693 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 http://www.oracle.com/technetwork/topics/security/cpuapr2009-099563.html http://www.securityfocus.com/bid/34461 http://www.securitytracker.com/id?1022055 http://www.us-cert.gov/cas/techalerts/TA09-105A.html •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2008-2583
https://notcve.org/view.php?id=CVE-2008-2583
Unspecified vulnerability in the sample Discussion Forum Portlet for the Oracle Portal component in Oracle Application Server, as available from OTN before 20080715, has unknown impact and remote attack vectors. Vulnerabilidad en el Foro de Discusión Portlet para el componente Oracle Portal en Oracle Application Server, como está disponible desde OTN anterior 20080715, tiene un impacto y vectores de ataque desconocidos. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143 http://secunia.com/advisories/31087 http://secunia.com/advisories/31113 http://www.oracle.com/technetwork/topics/security/cpujul2008-090335.html http://www.securitytracker.com/id?1020494 http://www.vupen.com/english/advisories/2008/2109/references http://www.vupen.com/english/advisories/2008/2115 •
CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2008-2589
https://notcve.org/view.php?id=CVE-2008-2589
Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3, 10.1.2.2, and 10.1.4.1 has unknown impact and remote attack vectors. NOTE: the previous information was obtained from the Oracle July 2008 CPU. Oracle has not commented on reliable researcher claims that this issue is a SQL injection vulnerability in the WWV_RENDER_REPORT package that allows remote attackers to execute arbitrary SQL (PL/SQL) commands via the second argument to the SHOW procedure. Una vulnerabilidad no especificada en el componente Oracle Portal en Application Server de Oracle versiones 9.0.4.3, 10.1.2.2 y 10.1.4.1, presenta un impacto desconocido y vectores de ataque remotos. NOTA: la información anterior fue obtenida de la CPU de julio de 2008 de Oracle. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143 http://secunia.com/advisories/31087 http://secunia.com/advisories/31113 http://www.oracle.com/technetwork/topics/security/cpujul2008-090335.html http://www.securityfocus.com/archive/1/494410/100/0/threaded http://www.securitytracker.com/id?1020494 http://www.vupen.com/english/advisories/2008/2109/references http://www.vupen.com/english/advisories/2008/2115 •
CVSS: 6.4EPSS: 0%CPEs: 4EXPL: 0CVE-2008-2609
https://notcve.org/view.php?id=CVE-2008-2609
Unspecified vulnerability in the Oracle Portal component in Oracle Application Server 9.0.4.3, 10.1.2.3, and 10.1.4.2 has unknown impact and remote attack vectors. Vulnerabilidad no especificada en el componente Oracle Portal de Oracle Application Server 9.0.4.3, 10.1.2.3 y 10.1.4.2 tiene impacto desconocido y vectores de ataque remotos. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00727143 http://secunia.com/advisories/31087 http://secunia.com/advisories/31113 http://www.oracle.com/technetwork/topics/security/cpujul2008-090335.html http://www.securitytracker.com/id?1020494 http://www.vupen.com/english/advisories/2008/2109/references http://www.vupen.com/english/advisories/2008/2115 •
CVSS: 5.0EPSS: 90%CPEs: 1EXPL: 2CVE-2008-2138 – Oracle Application Server Portal 10g - Authentication Bypass
https://notcve.org/view.php?id=CVE-2008-2138
Oracle Application Server (OracleAS) Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /dav_portal/portal/ by sending a request containing a trailing "%0A" (encoded line feed), then using the session ID that is generated from that request. NOTE: as of 20080512, Oracle has not commented on the accuracy of this report. Oracle Application Server (OracleAS) Portal 10g permite a atacantes remotos evitar las restricciones de acceso previstas y leer los contenidos de /dav_portal/portal/ mediante una petición que contiene un rastro "%0A" (avance de línea codificado) y utilizando a continuación el ID de sesión que se genera de esa petición. NOTA: a fecha del 12-05-2008, Oracle no ha comentado la exactitud de este repote • https://www.exploit-db.com/exploits/31770 http://secunia.com/advisories/30140 http://securityreason.com/securityalert/3867 http://www.securityfocus.com/archive/1/491865/100/0/threaded http://www.securityfocus.com/bid/29119 http://www.securitytracker.com/id?1020034 https://exchange.xforce.ibmcloud.com/vulnerabilities/42302 • CWE-264: Permissions, Privileges, and Access Controls •